Shikong/Clash.Meta
1
0
Fork 0
mirror of https://gitclone.com/github.com/MetaCubeX/Clash.Meta synced 2025-02-23 12:42:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

chore: adjust trust cert

Browse Source
This commit is contained in:
Skyxim 2023-03-27 22:27:59 +08:00
parent 6ca14c814e
commit 6d40de2179
1 changed files with 22 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
component/tls/config.go
View File

@ -14,7 +14,7 @@ import (
xtls "github.com/xtls/go" xtls "github.com/xtls/go"
) )
var trustCert, _ = x509.SystemCertPool() var trustCerts []*x509.Certificate
var mutex sync.RWMutex var mutex sync.RWMutex
var errNotMacth error = errors.New("certificate fingerprints do not match") var errNotMacth error = errors.New("certificate fingerprints do not match")
@ -25,16 +25,28 @@ func AddCertificate(certificate string) error {
if certificate == "" { if certificate == "" {
return fmt.Errorf("certificate is empty") return fmt.Errorf("certificate is empty")
} }
if ok := trustCert.AppendCertsFromPEM([]byte(certificate)); !ok { if cert, err := x509.ParseCertificate([]byte(certificate)); err == nil {
trustCerts = append(trustCerts, cert)
return nil
} else {
return fmt.Errorf("add certificate failed") return fmt.Errorf("add certificate failed")
} }
return nil
} }
func ResetCertificate() { func ResetCertificate() {
mutex.Lock() mutex.Lock()
defer mutex.Unlock() defer mutex.Unlock()
trustCert, _ = x509.SystemCertPool() trustCerts = nil
}
func getCertPool() *x509.CertPool {
certPool, err := x509.SystemCertPool()
if err == nil {
for _, cert := range trustCerts {
certPool.AddCert(cert)
}
}
return certPool
} }
func verifyFingerprint(fingerprint *[32]byte) func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error { func verifyFingerprint(fingerprint *[32]byte) func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
@ -84,12 +96,13 @@ func GetSpecifiedFingerprintTLSConfig(tlsConfig *tls.Config, fingerprint string)
} }
func GetGlobalTLSConfig(tlsConfig *tls.Config) *tls.Config { func GetGlobalTLSConfig(tlsConfig *tls.Config) *tls.Config {
certPool := getCertPool()
if tlsConfig == nil { if tlsConfig == nil {
return &tls.Config{ return &tls.Config{
RootCAs: trustCert, RootCAs: certPool,
} }
} }
tlsConfig.RootCAs = trustCert tlsConfig.RootCAs = certPool
return tlsConfig return tlsConfig
} }
@ -106,12 +119,13 @@ func GetSpecifiedFingerprintXTLSConfig(tlsConfig *xtls.Config, fingerprint strin
} }
func GetGlobalXTLSConfig(tlsConfig *xtls.Config) *xtls.Config { func GetGlobalXTLSConfig(tlsConfig *xtls.Config) *xtls.Config {
certPool := getCertPool()
if tlsConfig == nil { if tlsConfig == nil {
return &xtls.Config{ return &xtls.Config{
RootCAs: trustCert, RootCAs: certPool,
} }
} }
tlsConfig.RootCAs = trustCert tlsConfig.RootCAs = certPool
return tlsConfig return tlsConfig
} }